Introduction
Network Security Groups (NSGs) in Azure are fundamental in managing network traffic to and from Azure resources. Configuring inbound and outbound security rules is key to maintaining a secure and efficient cloud environment. This guide will walk you through the process, highlighting all the essential fields and how they change based on the source value.
Azure continues to improve NSGs with modern capabilities such as NSG Flow Logs v2, Traffic Analytics, enhanced service tags, rule hit counts, and improved integration with Azure Firewall, Private Endpoints, and Azure Monitor. These new features help improve visibility, troubleshooting, and security posture across cloud environments.
What are NSG Security Rules?
Azure NSGs contain rules that control inbound and outbound network traffic. Inbound rules manage the traffic coming into our resources, while outbound rules control the traffic leaving them. Each rule in an NSG allows or denies traffic based on several criteria like source, destination, port, and protocol.
NSGs are stateful, meaning that if an inbound rule allows traffic, the return outbound traffic is automatically allowed, and vice versa. This simplifies rule configuration and reduces the need for reciprocal rules.
Fields in NSG Security Rules
When configuring both inbound and outbound rules in an NSG, we will encounter the following fields:
Source
Description: Specifies where the network traffic originates.
Possible Values: IP Addresses/Ranges, Service Tags, Application Security Groups (ASGs), ‘Any’, ‘My IP Address’.
Source port ranges
Description: Defines the port(s) on the source side that the rule applies to.
Possible Values: Single port (e.g., ’80’), port ranges (e.g., ‘1000-2000’), or ‘*’ for any port.
Note: In most real-world scenarios, source ports use ephemeral random ports, so this is usually set to
*.
Destination
Description: Identifies the destination of the network traffic.
Possible Values: IP Addresses/Ranges, Service Tags, Application Security Groups (ASGs), ‘Any’.
Service
Description: Allows us to choose predefined destination services such as RDP, SSH, etc., and their respective port ranges and protocols will be populated. The default is Custom, which allows us to specify the destination port ranges and protocol.
Allowed Values: The list is long but includes RDP, SSH, HTTP, HTTPS, Custom, etc.
Note: This is a UI convenience feature—internally, NSGs still use destination port + protocol fields.
Destination port ranges
Description: Specifies the port(s) on the destination side that the rule applies to.
Possible Values: Single port (e.g., ‘443’), port ranges (e.g., ‘8000-8080’), or ‘*’ for any port.
Protocol
Description: The network protocol to which the rule applies.
Possible Values: ‘TCP’, ‘UDP’, ‘ICMP’, or ‘*’ for any protocol.
Action
Description: Determines whether the rule allows or denies traffic.
Possible Values: ‘Allow’, ‘Deny’.
Priority
Description: A number indicating the precedence of the rule (lower numbers have higher priority).
Possible Values: Any number between 100 and 4096.
Name
Description: A unique identifier for the rule.
Possible Values: Any user-defined name.
Description (optional)
Provides additional information about the rule.
Source Field Options and Their Additional Fields
Based on source field selection, additional fields may be available. Possible values for the source field and additional fields based on source field values selection are as follows:
Any
Description: Represents traffic from all possible IP addresses.
Additional Fields: None required. Selecting ‘Any’ implies the rule applies universally, without IP address-based filtering.
IP Addresses
Description: Specifies traffic from individual IP addresses or a range of IP addresses.
Additional Fields:
- Source IP addresses/CIDR ranges: You need to specify the specific IP address (e.g., 192.168.1.1) or a range of addresses (e.g., 192.168.1.0/24).
- Multiple IPs or ranges can be separated by commas.
My IP Address
Description: Automatically uses the public IP address of your current internet connection.
Additional Fields: This option dynamically sets the Source IP addresses/CIDR ranges to our current public IP address.
Service tag
Description: Represents a group of IP address prefixes from Azure services (like Azure Storage, Azure SQL Database, etc.), simplifying rule management.
Additional Fields:
- Service Tag Selection: You need to select from a list of predefined Azure service tags (e.g., VirtualNetwork, Internet, AzureLoadBalancer, AzureAI, MachineLearning, AzureMonitor, etc.).
Application security group
Description: Allows us to define the source as a group of VMs using ASGs.
Additional Fields:
- Source application security groups: Choose from the Application Security Groups defined within our Azure environment.
Note: ASGs must be in the same region and subscription.
Important Behaviors and Modern Considerations
NSGs and Private Endpoints
NSGs do not apply to the NIC of Private Endpoints. They apply only at the subnet level for Private Endpoint subnets.
NSGs vs Azure Firewall
NSGs provide Layer 3/4 filtering, while Azure Firewall provides:
- Layer 7 filtering
- FQDN/URL filtering
- Threat intelligence
- Outbound SNAT
- Central logging
They are complementary, not competing, and often used together.
NSG Rule Hit Count
The Azure portal now shows how many times each rule has matched traffic, helping identify unused or overly permissive rules.
Diagnostics, Monitoring, and Logging (Modern Additions)
Azure has significantly improved NSG observability:
NSG Flow Logs v2
Captures details such as:
- Source/destination IP
- Ports
- Protocols
- Allow/Deny status
Traffic Analytics
Provides:
- Visual traffic maps
- Hotspot detection
- Top talkers
- Security recommendations
Azure Monitor Integration
You can now get NSG insights directly in Azure Monitor for unified dashboards.
Overview of Steps to Configure NSG Rules
Accessing NSG Settings
- Log into Azure Portal.
- Navigate to the ‘Network Security Groups’ section.
- Select the NSG you wish to configure.
Adding/Editing a Rule
- Choose either ‘Inbound security rules’ or ‘Outbound security rules’.
- Click ‘Add’ to create a new rule or select an existing rule to edit.
- Fill in the necessary fields:
- Name, Priority, Action, Protocol
- Source/Destination: Choose the appropriate type and fill in the details
- Source/Destination Port Ranges: Specify the ports
- Add a Description if needed
- Save the rule.
Best Practices
Prioritize Rules Carefully
The priority determines the order in which rules are processed.
Be Specific
Narrow down the source and destination to minimize potential security risks.
Regularly Review Rules
Ensure that your rules are up-to-date and remove any that are no longer needed. Use rule hit counts to find unused rules.
Log and Monitor Traffic
Enable NSG Flow Logs + Traffic Analytics for real-time visibility.
Use Service Tags and ASGs
They simplify large-scale rule management and reduce errors.
Combine NSGs with Azure Firewall
For enterprise-grade outbound control and threat protection.
Conclusion
Configuring inbound and outbound rules in Azure NSGs is a critical task for managing your cloud environment’s security. By understanding the various fields and how to effectively use them, you can ensure your Azure resources are well-protected and accessible as needed.
With improved diagnostics, new service tags, Private Endpoint considerations, rule hit counts, and deeper Azure Firewall integration, NSGs continue to be a powerful and central component of Azure security architecture.
See also
Related Labs
- R4211 – Creating NSG Rules to Secure Access to VM
- R4216 – NSG Rules – Subnet vs NIC
- R4221 – NSG Rules Priority
- R4226 – Deleting NSGs Associated with Subnet and NIC